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SYSTEM AND IMPLEMENTATION METHOD OF CONTROLLED MULTICAST 



(57) A system and method for implementing control- 
led multicast, wherein comprises Ethernet switch 1 , mul- 
ticast router 2, as well as portal server 3 and AAA server 
4 that connect with the multicast router, where Ethernet 
switch 1 connects with each hosts of user in a downlink, 
in an uplink connects with multicast router 5 and imple- 
ments multicast switch of layer 2; portal server 3 is used 
as an interface for access authentication of the user, 
AAA server 4 Is used to store configuration of user priv- 
ilege for joining in a multicast group; multicast router 2 
connects with multicast router 5 of other systems in the 
uplink, and cooperates together with AAA server 4 to 
completes privilege authentication for the user when he 
joins in the multicast group, distributes a control com- 
mand according to results of the authentication, and 
controls forwarding of the multicast made by Ethernet 
switch 1. The method according to Ihe present invention 
can resolve better the authenticated authorization and 
controlled problem of the sender and receiver joining in 
the multicasl, and can Identify the host joining in or leav- 
ing the multicast group expediently, actively stop the us- 
ers group member identification through offline without 
any influence on the forwarding efficiency. 
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Description 

Field of the Technology 

[0001] The present invention relates generally to an 
IP multicast technique, and more particularly, to an IP 
controlled multicast system and thereof implementation 
method in a telecommunication technological field. 

Background of the Invention 

10002] Along with maturation of the IP multicast tech- 
nique, application of the IP multicast Is becoming in- 
creasingly widespread. However, In an IP model, any 
host can join into any of the multicast groups without 
limitation, and until now, there are no effective methods 
that can solve the controlled join problem of a host in an 
IP multicast network. 

[0003] It is well known that, in the IP multicast model, 
a multicast group comprises senders and receivers, 
which are connected with a multicast Distribution Tree. 
When the sender needs to send data to a certain group, 
the host will transmit the data directly to the multicast 
router which connects with the host, and the multicast 
router then forwards the data to the multicast receiver 
via the multicast Distribution Tree without any limitation 
on the host that sends messages. As soon as a host 
wants to get data from a certain multicast group, the host 
sends a Member report message to its connected mul- 
ticast router according to an Internet Group Manage- 
ment Protocol (IGMP for short), and the multicast router 
will then forward the data of the multicast group to the 
host after the Member report message is processed; 
similarly, the multicast router will not make any limita- 
tions on the host which wants to obtain the multicast 
message. With the development of commercialization 
in IP multicast application, multicast security has be- 
come an urgent problem that should be solved as soon 
as possible, a key of which is prohibiting unauthorized 
receivers to receive the multicast messages. 
[0004] Ncrihlro Ishikawa et al proposed an IGMP ex- 
tension protocol 'IGMP Extension for Authentication of 
IP Multicast" (published at draft-ietf-idmr-igmp-auth- 
01.txt) and a RADIUS extension protocol "RADIUS Ex- 
tension for Multicast Router Authentication", (where, the 
RADIUS is abbreviation of Remote Authentication Dial 
In User Service, which is published at draft-ya- 
manouchi-RADIUS-ext-O0.txt), with which authentica- 
tion for the sender and the receiver can be made. 
[0005] The IGMP extension protocol above is exten- 
sion made based on an IGMP V2 (version 2), in which 
authentication function for the multicast sender and the 
multicast receiver is added, to prevent unauthorized us- 
ers from sending/receiving multicast packets. The IGMP 
extension protocol adopts a Challenge-Response 
mechanismthatissimilarwith a PPP authentication pro- 
tocol CHAP (Challenge Handshake Authentication Pro- 
tocol} such as thrice handshakes, encrypted password 



to make user authentication. Once a multicast sender 
begins to transmit IP multicast messages, an Ingress 
router may make authentication for it with the challenge- 
response mechanism. The Ingress router may utilize a 

s RADIUS as an authentication server during the authen- 
tication process. When the authentication is successful, 
the multicast packets from the sender will be forwarded 
by the Ingress router to the IP multicast network and 
then to an Egress router. When the authentication is 

'0 failed, the Ingress router will discard the multicast pack- 
ets silently. Authentication made by the Egress router is 
needed when the multicast receiver wants to receive IP 
multicast messages. The Egress router may also adopt 
the RADIUS as the authentication server during the au- 

is thentlcalion process. Once the authentication suc- 
ceeds, the Egress router begins to transmit the IP mul- 
ticast packets to the receiver; Otherwise, no IP packets 
will be forwarded to the receiver. 
[0006] The RADIUS extension protocol above is ex- 

» tension made In the basis of the RADIUS, which may 
make authentication for the multicast sender and the 
multicast receiver at the Ingress router and the Egress 
router, and track multicast data of the user to provide 
data for service management. The authentication server 
must be able to provide the authentication service re- 
quired by the multicast router, meanwhile, the multicast 
router might provide identification (User ID) and pass- 
word of the user. In order to insure security, authentica- 
tion process must be based on the challenge, and every 

» service must be authenticated, for instance, authentica- 
tion must be made on the address of each multicast 
group. The reason is that multicast packets are trans- 
mitted according to the group address, and the authority 
of the user should be correlative with the group. Except 

s for some additional attributes, other requirements are 
just the same with that of the RADIUS. Whether or not 
the multicast router makes RADIUS authentication is 
optional. 

[0007] When being configured to support RADIUS 
o charging, the multicast router will generate a charging 
start message at the beginning of the multicast service, 
and send to a RADIUS multicast charging server, 
wherein the message describes type of the service. Af- 
ter receiving the charging start message, the RADIUS 
5 multicast charging server will return a confirmation mes- 
sage. When the multicast service is completed, the mul- 
ticast router also generates a charging end message, 
and sends the message to the RADIUS multicast charg- 
ing server. After receiving the message, the RADIUS 
» multicast charging server will also return a confirmation 
message, wherein the charging end message describes 
type of (he service. 

[0008] After receiving an IGMP Join request, the mul- 
ticast router sends an Access-Request message to a 
> RADIUS multicast authentication server to ask for au- 
thentication. After receiving a response from the RADI- 
US multicast authentication server that Indicates the au- 
thentication is successful, the multicast router sends an 
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Account-Request/Start message to tha RADIUS multi- 
cast charging server to start charging. While receiving 
an IGMP Leave request, the multicast router may send 
an Account-Request/Stop message to the multicast 
charging server to terminate the charging. If no re- 5 
sponse is returned to tha multicast router within certain 
period of time, the RADIUS extension protocol advices 
thB multicast router to resend the Access-Request mes- 
sage several times continuously. The multicast charging 
server can also ask other servers (such as a proxy sev- 10 
er) to implement the charging function. While bBing un- 
able to record charging message successfully, the mul- 
ticast charging server cannot send an Accounting-Re- 
sponse confirmation message to the multicast router. 
[0009] Moreover, CISCO tnc develops a CISCO is 
Group Management Protocol (named CGMP for short), 
which is used for solving a multicast forward flooding 
problem under circumstance of an Ethernet switch; with 
the CGMP, a layer 3 equipment can control a forwarding 
table of a layer 2 equipment, which provides a mean to » 
control authorized recaption in a certain extent. As 
shown in Fig,1, CGMP message is composed by 
number of edition (Ver, 4 bits), Type (4 bits), Reserved 
part (2 bytes), number of GDA/USA pairs in the mes- 
sage (Count, 1 byte) and several GDA/USA pairs, ss 
Wherein, the GDA (Group Destination Address) is a 
MAC multicast address that corresponds to an IP ad- 
dress of the multicast group that the host wants to join 
in; the USA (Unicast Source Address) is a MAC address 
of the host which wants to Join in the multicast group and 30 
is a unicast address. 

[0010] As shown In Flg.2, process of the CGMP Is as 
follows. Host 1 sends an IGMP Membership Report 
message to join in multicast group 224. 1 .2.3; the switch 
uses MAC address 0100.5e01.0203 that corresponds 35 
to the address of multicast group resoluted from the 
message to search its matching terms In a CAM (CAM: 
Content-Addressable Memory) table; because there is 
no its matching terms in the CAM table, the message is 
forwarded (flooding) to all the ports, including a CPU and *o 
multicast routers. Wherein, after receiving the IGMP 
Membership Report message, the multicast router, be- 
sides implementing routine disposal, produces a CGMP 
Join message and multlcasts to the switch, which com- 
prises the MAC address (USA: 0080.c7a2.1093) of the « 
host which applies to join In the multicast group, the 
MAC address (GDA: 0100.5e01 .0203) of the multicast 
group which is applied to join in, as well as a Join com- 
mand field. After receiving the CGMP Join message, the 
swilch may add an entry in the CAM table, which in- so 
eludes the GDA (0100.5e01.0203 in the drawings), the 
port number (marked as 2 in the drawings) of the host 
which wants to join in the multicast group, and the port 
number (marked as 1 in the drawings) of the multicast 
router that connects with the switch. Wherein, the port « 
number of the host Is obtained through searching the 
USA. 

[0011] As shown in Flg.3, when the fourth host 4 joins 



in multicast group 224.1.2.3. It will similarly send the 
IGMP Membership Report message to the switch; after 
having resoluted the IP address of the destination group 
is 224.1 .2.3, the switch may find the entry after search- 
ing In the CAM table with the corresponding MAC ad- 
dress 0100.5e01.0203 of the IP address , and forward 
the message to port 1 and 2 (which are the multicast 
router and host 1 respectively) listed in the entry. After 
receiving the IGMP Membership Report message, be- 
sides making routine disposal, the multicast router pro- 
duces a CGMP Join message and multicasts to the 
switch, which comprises the MAC address of the host 
which applies to join in the multicast group (USA: 
0080.c7b3.2174) and the MAC address (GDA: 
01 00.5e01 .0203) of the multicast group which is applied 
to join in. as well as the Join command field. After re- 
ceiving the CGMP Join message, the switch may obtain 
an entry through searching in the CAM table with GDA, 
and get port number 5 of host 4 via searching in the CAM 
table with USA, meanwhile add port number 5 into the 
entry. 

[0012] Although the Synergic extension method be- 
tween the IGMP and the RADIUS above has solved the 
authorization problems for the sender and the receiver, 
some shortcomings still exist. 

(1 ) Once a host Join in the multicast group success- 
fully in a shared network, all the other hosts will be 
able to receive the multicast data, which means, it 
is impossible to prevent the unauthorized hosts 
from receiving the multicast data. If a key method 
is adopted to solve the problem, distribution of keys 
before authentication for each host will bring numer- 
ous limitations and troubles. 

(2) If both these two protocols are adopted, it is nec- 
essary not only to renew the multicast router equip- 
ment, but also to modify IGMP software in the host 
side. Furthermore, none of these two protocols is 
standardized; the present hosts donl support the 
IGMP extension. 

[0013] Defects of the CGMP means of CISCO Inccan 
be noticed as follows. 

(1) No relation between forwarding control on the 
layer 2 switch controlled by the multicast router and 
authorized reception of the host/user is provided, 
and no authenticating and authorizing method for 
the user to join in the multicast group is provided 
either, all the control methods provided area control 
method for the multicast message of the layer 2 
switch flooding at its port. 

(2) The multicast router cannot detect "Silent 
Leave" of the host /user. 

Summary of the Invention 

[001 4] It is an object to provide a controlled multicast 
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system, in order to provide application environment for 
a controlled multicast method of the invention. 
[0015] It is another object to provide the method for 
implementing controlled multicast, In order to solve mul- 
ticast disadvantages of the prior arts, which include syn- 5 
ergic method between the IGMP extension and the RA- 
DIUS extension, and the CGMP of CISCO Inc; al the 
same time, the method can preferably solve problems 
of authorization authentication and controlled join of the 
sender and receiver which participate in the multicast. >o 
[0016] A controlled multicast system, including an 
Ethernet switch and a multicast router, wherein, the Eth- 
ernet switch connects with each host of a user in a down- 
link, connects with the multicast router in a uplink, the 
multicast router connects with a multicast routarof other is 
systems In the uplink, the Ethernet switch implementing 
multicast exchange of a layer 2, an IGMP V2 protocol is 
adopted as group management protocol between the 
Ethernet switch and the host of the user; the controlled 
multicast system further comprises: a portal server and 20 
an AAA server that connect with the multicast router; the 
portal server acting as an interface of user access au- 
thentication, the AAA server being used for storing con- 
figuration of privilege for the user to join in a multicast 
group; the multicast router cooperating with the AAA K 
server together to implement privilege authentication for 
the user to join in the multicast group, and distributing 
control commands according to results of the authenti- 
cation to control multicast forwarding operations of the 
Ethernet switch. 30 
[0017] A RADIUS* protocol extended from an AAA 
protocol is adopted as communication protocol between 
the multicast router and the AAA server; a group man- 
agement protocol HGMP (Huawei Group Management 
Protocol) is used as a control protocol between the Eth- 3S 
ernet switch and the multicast router. 
[0018] A method for implementing a controlled multi- 
cast, comprises: implementing access authentication 
first; then an Ethernet switch classifying a vlan accord- 
ing to a port and handling an IGMP message from a « 
host, implementing user identification, authentication for 
joining in a multicast group, and a multicast router han- 
dling the IGMP message; in succession, the multicast 
router controlling the Ethernet switch for multicast for- 
warding, between which a HGMP protocol is used as a « 
control protocol of the controlled multicast; after that, the 
Ethernet switch disposing a HGMP control message 
and forwarding a multicast flow; the host leaving the 
multicast group and making corresponding processes 
after finishing the forwarding operation. » 

wherein the stBp of implementing access authen- 
tication comprises, 

(1 ) when accessing a network, the host inputting an 
authentication information that includes a User ID ss 
and a password first through an interface provided 
by a portal server, and a AAA server authenticating 
identification of the host with the Information; once 



the authentication is successful, the multicast router 
recording the User ID and a corresponding vlan ID 
of the host in a multicast access privilege table of 
the user; 

the step of the Ethernet switch classifying the 
vlan according to the port and handling the IGMP 
message from the host comprises, 

(2) classifying the vlan according to the ports, with 
one vlan for each port, and linking one port to one 
host; searching a Content-Addressable Memory 
(CAM) table with a destination MAC address of the 
IGMP message sent by the host and forwarding the 
said IGMP message, of which forwarding process 
is same with that of a unicast message: if the port 
corresponding to the destination MAC address is 
found, forwarding the multicast message to the port, 
otherwise forwarding the multicast message to ail 
the ports; 

the step of implementing user identification, 
authentication for Joining in the multicast group, and 
handling the IGMP message by the multicast router 
comprises, 

(3) after receiving an IGMP Membership Report 
message, according to the vlan ID in the message, 
the multicast router finding the corresponding User 
ID and the host to which the IGMP Membership Re- 
port message belongs through searching in the 
multicast access privilege table of the user recorded 
in step (1), and then sending an extended RADIUS 
authentication message which includes the User ID 
just found as the user name and the address of mul- 
ticast group in which the host wants to join as an 
attribute, to the AAA server for authentication; 

the AAA server determining whether to accept 
the user based on services of the user; if the user 
has the suitable privilege, responding wllh an ac- 
ceptance message, otherwise returning a reject 
message; after receiving the reject message, the 
multicast router do nothing, but if receiving the ac- 
ceptance message, the multicast router writing the 
address of the multicast group in which the user can 
join Into the multicast access privilege table of the 
user, and implementing a routine disposal on join 
messages of the host, then generating and trans- 
mitting a HGMP Join message to the Ethernet 
switch, which comprises the vlan ID corresponding 
to the port that links with the host which wants to 
join in the multicast group, the address of the mul- 
ticast group that is applied for, and a Join command 
field; moreover, the multicast router also completing 
a routine processing of creating multicast forward- 
ing tree on the IGMP Membership Report message 
just like an ordinary multicast router does; 

the step of the multicast router controlling the 
Ethernet switch making the multicast forwarding 
with the HGMP protocol being control protocol of 
the controlled multicast comprises. 
(4) managing generation and deletion of an entry In 
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the CAM table at the Ethernet switch by the multi- 
cast router; while allowing the host to join in the mul- 
ticast group, the multicast router sending the HGMP 
Join message that includes the vlan IO or the host 
which applies to join in the multicast group and the s 
address of the multicast group applied for to the Eth- 
ernet switch; when the multicast router wants to ter- 
minate the host joining in the multicast group, the 
multicast router transmitting a HGMP Leave mes- 
sage which comprises the vlan ID of the host which » 
leaves the multicast group and the address of the 
multicast group where the host leaves; 

the step of the Ethernet switch disposing the 
HGMP control message comprises, 
(S) after receiving the HGMP Join message, the « 
Ethernet switch searching the CAM table with the 
MAC address corresponding to the address of the 
multicast group; if the entry corresponding with the 
address is found, the Ethernet switch obtaining the 
port number of the host via the vlan ID in the HGMP » 
Join message, and then adding the port number Into 
the said entry; if nothing is found, adding an entry 
in the CAM table, which comprises the MAC ad- 
dress corresponding to the multicast address, the 
port number of the host which applies to join in the & 
multicast group, and the port number of the multi- 
cast router connected with the Ethernet switch; 

after receiving the HGMP Leave message, 
the Ethernet switch obtaining the entry through 
looking up the CAM table with the MAC address cor- 30 
responding to the multicast address of the multicast 
group, and getting the port number of the host 
through the vlan ID, and then deleting the said port 
number from the said entry, if the said port number 
is the solely port of the said entry, deleting the whole 35 
entry; 

the step of forwarding of the multicast flow 
comprises, 

(6) when receiving the multicast flow sent from the 
multicast source, the multicast routerforwarding the <o 
multicast flow to an egress based on a CAM table; 
when handling the IGMP Membership Report mes- 
sage of the host, the multicast router creating a mul- 
ticast forwarding egress according to the real port 

of the Ethernet switch, and sending only one copy 45 
of the multicast flow to the Ethernet switch; 

the step of the host leaving the multicast 
group comprises, 

(7) after finishing the multicast and wanting to leave 
the multicast group , the host sending an IGMP so 
Leave message; after receiving the IGMP Leave 
message, the multicast router extracting the vlan ID 
from the message, and obtaining corresponding en- 
try via searching in the multicast access privilege 
table created In step (1) with the vlan ID. then de- 55 
leting the address of the multicast group indicated 

by the IGMP Leave message in the entry; after com- 
pleting a routine disposal on leave messages, the 



multicast router generating the HGMP Leave mes- 
sage and sending to the Ethernet switch, which in- 
cludes the vlan ID of the host which wants to leave 
group, the address of multicast group where the 
host wants to leave and a Leave command field. 

wherein the CAM table and the unicast forwarding 
table of the Ethernet switch are shared. 

wherein, during the messages forwarding, adopt- 
ing a vlan protocol between the port of the multicast rout- 
er and the Ethernet switch. 

in step (6) there is no vlan ID in a multicast data 
packet of the multicast flow sent from the multicast rout- 
er. 

in step (7) of leaving from the multicast group can 
also be implemented via following means which com- 
prises, once the multicast router knows offline status of 
(he user, the multicast router actively sending the HGMP 
Leave message to terminate multicast flow transmission 
to the host, which is same with that of processing on the 
IGMP Leave message. 

[0019J The method further comprises controlling the 
multicast sender, which includes when the host trans- 
mils data to the multicast group, the first receiver among 
the multicast routers filtering the data message with a 
multicast Access Control List (ACL), and forwarding the 
data message that satisfies the requirements in the ACL 
to the multicast tree. 

wherein the multicast ACL comprises a command 
word, a source address and a group address. 

wherein the multicast ACL Is distributed to each 
multicast router by a centralized multicast service con- 
trol server; the step of controlling the sender is accom- 
plished with the multicast ACL by the multicast router, 
meanwhile the multicast service control server is also 
acts as the AAA server. 

wherein the multicast ACL can also be distributed 
by a centralized policy server or a network manager. 
[0020] The main advantages of the present invention 
are as following. The method provides an effective tech- 
nical means for authenticated authorization when the 
user join in the multicast group, in order to ensure that 
only the authorized user can join in the multicast group; 
through one-to-one relationship among the port, the us- 
er and the vlan ID, together with access authentication 
for the user, the user who joins in or leaves the multicast 
group can be easily identified. The multicast router can 
make the active and decisive control on the multicast 
forwarding function of the layer 2 switch, and distribute 
its control policy to the Ethernet switch, which can pref- 
erably solve the controlled problems in the IP multicast 
service. Secondly, when the host leaves the multicast 
group without sending the IGMP Leave message, for in- 
stance, when multicast application program terminates 
abnormally, the group membership can be actively ter- 
minated through offline of the user. What is more, there 
is no Influence on forwarding efficiency after introduction 
of the control means according to the present Invention. 
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The method in the present invention has a splendid ap- 
plication future. 

Brief Description of the Drawings 

5 

[0021] 

Fig.1 is a schematic diagram of the CGMP message 
format in the prior art. 

Fig.2 Is a schematic diagram illustrating flow dlrec- » 
tion of the signal that host 1 first joins in multicast 
group 224. 1 .2.3 in process of the CGMP in the prior 
art. 

Fig.3 is a schematic diagram illustrating flow direc- 
ttonofthesignalthat host4second joins inmufticast *s 
group 224.1 .2.3 tn process of the CGMP in the prior 
art. 

Fig.4 is a schematic diagram illustrating the system 
structure of the controlled multicast system accord- 
ing to the present Invention. 20 
Fig.5 is a schematic diagram Illustrating flow direc- 
tion of the signal while making access authentica- 
tion for host 1 in the controlled multicast according 
to the present invention. 

Flg.6 is a schematic diagram Illustrating flow dlrec- 2s 
tion of the signal that host 1 first joins in multicast 
group 224.1.2.3 in the controlled multicast accord- 
ing to the present invention. 
Fig.7 is a schematic diagram illustrating flow direc- 
tion of the signal that host 4 second joins in multicast 30 
group 224.1.2.3 In the controlled multicast accord- 
ing to the present Invention. 
Fig.8 is a schematic diagram illustrating flow direc- 
tion of the signal with which the multicast router for- 
wards the multicast flow in the controlled multicast 35 
according to the present invention, 
Fig.9 is a schematic diagram illustrating flow direc- 
tion of the signal that Indicates host 1 leaves multi- 
cast group 224.1 .2.3 in the controlled multicast ac- 
cording to the present invention. <o 
Fig. 10 Is a schematic diagram illustrating the cen- 
tralized control scheme in the controlled multicast 
system according to the present invention. 

Embodiments of the Invention 45 

10022] The present invention will be described in more 
detail hereinafter with reference to the accompanying 
drawings. 

[0023] Now refer to Flg.4. The Invention provides the so 
controlled multicast system that Includes Ethernet 
switch 1 and multicast router 2, wherein Ethernet switch 
1 connects with each hosts of the user In the downlink, 
and in the uplink with multicast router 2 which further 
connects with multicast router 5 of other systems; the 55 
IGMP V2 (version 2) protocol is used as group manage- 
ment protocol between the host and the Ethernet swilch 
who implements multicast exchange of layer 2. The con- 



trolled multicast system further comprises: portal server 
3 and AAA server 4 that connect with multicast router 2, 
wherein, portal server 3 is used as the interface of ac- 
cess authentication for the users. AAA server 4 is used 
for storing Privilege configuration of the users who want 
to join in the multicast group, a Client-server structure 
is adopted between AAA server 4 and multicast router 
2, and the multicast router 2, together with AAA server 
4, makes authentication for the privilege of users who 
want to join in the multicast group, and distributes con- 
trol orders according to results of the authentication, in 
order to control forwarding operation of the multicast 
made by Ethernet switch 1. In the invention, the RADI- 
US* protocol that is extended from the standard RADI- 
US protocol is adopted as communication protocol be- 
tween multicast router 2 and AAA server 4, meanwhile, 
the group management protocol HGMP is usBd as con- 
trol protocol between Ethernet switch 1 and multicast 
router 2. 

[0024] The implementing method and operational 
steps of the complete process for the host Joining In the 
multicast group according to the present invention will 
be described in more detail hereinafter with reference 
to the accompanying drawings from Fig.5 to Fig.10 and 
an embodiment. 

[0025] As shown in Fig.5. when a certain host (sup- 
posing host 1 ) wants to access the network, first the host 
must make authentication through the interface provid- 
ed by the portal server; the AAA server is an authenti- 
cation server. The User ID in the pane at right side of 
the AAA server in the drawing represents the user name 
input by the user while making authentication, and group 
represents address of the multicast group In which the 
user wants to join. The Ethernet switch (LAN Switch) 
classifies the vlan according to the ports, each of which 
connects with one user. Wherein port 1 links the multi- 
cast router, and the ports from 2 to 5 connect each host 
from 1 to 4 respectively. Once the authentication is suc- 
cessful, the multicast router will record the User ID of 
host 1 (i.e. host 1) and the corresponding vlan number 
(i.e. vlan 1 ) of host 1 (here, assuma the user name in a 
user account of host 1 is host 1 ). 
[0026] As shown In Fig.6. when host 1 wants to join 
In the multicast group (assuming the group 224.1.2.3), 
the host may send the IGMP Membership Report mes- 
sage to join in multicast group 224.1 .2.3; the Switching 
Engine searches in the CAM table with the destination 
MAC address 0100.5e01.0203 in the message; be- 
cause there is no matching terms in the CAM table, the 
message is forwarded (flooding) to all the ports, includ- 
ing the CPU and the multicast router, wherein, accord- 
ing to receiving ports, the message that is forwarded to 
the multicast router will be attached with the vlan 
number (in case of host 1 , it is vlaM ). 
[0027] After receiving the IGMP Membership Report 
message, the multicast router extracts the vlan ID (vlan 
1) from the message, with which obtaining the User ID 
(host 1) corresponding to the user; the multicast router 
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appoints the found User ID as the user name, making 
the address (224.1 ,2.3) of multicast group in which the 
host wants to join as its attribute, sending the extended 
RADIUS authentication message to the AAA server for 
authentication; the AAA server determines whether to s 
accept the user according to the service that he applied 
for. If the user has a certain privilege, the multicast router 
may response with the acceptance message, otherwise 
send the reject message as response. In case of receiv- 
ing the reject message, the multicast router will do noth- « 
ing; once the received message is the acceptance mes- 
sage, the multicast router will record the address of the 
multicast group where the user can join into the multi- 
cast access privilege table of the user, and make the 
routine process of the multicast router on the message, K 
then generate and transmit the HGMP Join message to 
the switch, which comprises the vlan number (vlan 1) of 
the host which applies to join in the multicast group, the 
address (224.1.2.3) of the multicast group in which the 
host applies to join, and the Join command field. a 
{0028] After receiving the HGMP Join message, the 
switch will add an entry in the CAM table, which com- 
prises the MAC address (01 OO.Se0 1.0203) that is cor- 
responding to the multicast address (224.1.2.3), port 
number (2) of the host which applies to join in the mul- » 
ticast group and port number (1 ) of the multicast router 
that connects with the switch. Wherein, the port number 
of the host is obtained through searching in a table with 
the vtan ID. 

[0029] Now refer to Fig.7. When other new host (as- 30 
sume the fourth host 4) joins multicast group 224.1.2.3 
(assume the host has already passed the access au- 
thentication in the same way with that of host 1 in the 
first step), and also sends the IGMP Membership Report 
message to the switch, the Switching Engine finds the 35 
entry via searching in the CAM table with the destination 
MAC address 0100.5e01.0203, and then sends Ihe 
message to port 1 and 2(i.e. the multicast router and 
host 1 ) listed in the entry. 

[0030] After receiving the IGMP Membership Report « 
message, the multicast router extracts the vlan JD (vlan 
4) from the message, with which the multicast router 
finds the User ID (host 4) corresponding to the user 
through searching in the multicast access privilege ta- 
ble, and then appointing the User ID as the user name, « 
the address (224. 1 .2.3) of the multicast group where the 
host wants to join as its attribute, finally transmits the 
extended RADIUS authentication message to the AAA 
server for authentication; the AAA server will determine 
whether to accept the user according to the service he so 
applied for. If the user has a certain privilege, the multi- 
cast router may response with the acceptance mes- 
sage, otherwise send the reject message as response. 
In case of receiving the reject message, the multicast 
router will do nothing; once the received message is the ss 
acceptance message, the multicast router will write the 
address of the multicast group in which the user can join 
Into the multicast access privilege table of the user, and 



make routine process of the multicast router on the join 
message of the host, then generate and transmit the 
HGMP Join message to the switch, which includes the 
vlan number (vlan 4) of the host which applies to join in 
the multicast group, the address (224. 1.2.3) of the mul- 
ticast group in which the host applies to join, and the 
Join command field. 

[0031] After receiving the HGMP Join message, the 
switch will search in the CAM table with the MAC ad- 
dress (0100.Se01.0203) that corresponding to the ad- 
dress (224.1 .2.3) of the multicast group; because there 
exits the entry in the CAM table after host 1 have joined 
the group 224.1.2.3 in the above step as shown In Fig. 
6. the same entry that is identical with the result of fast 
search will be obtained; the port number of the host (5) 
will be added in the entry after the port number 5 is ob- 
tained through searching in the CAM table with the vlan 
ID. 

[0032] As shown in Fig.8, when the multicast router 
receives the multicast flow sent from the multicast 
source, the multicast flow will be forwarded to the egress 
according to the CAM table. Because the multicast rout- 
er creates the multicast forwarding egress based on the 
real ports of the switch ratherthan the vlan number when 
handling thB IGMP Membership Report message of the 
host, the switch connected with the multicast router has 
only one egress in the CAM table, and only one copy of 
the multicast flow Is transmitted to the switch, without 
the vlan ID in the multicast data packet. 
[0033] As shown In Fig.9, once wanting to leave mul- 
ticast group 224.1. 2.3, host 1 may send the IGMP Leave 
message to the switch; In the Fig.9, what corresponds 
to the IGMP Leave message sent by host 1 is the arrow 
drawn from host 1, and the Switching Engine searches 
In the CAM table with destination MAC address 
0100.5e01.0203; after finding the entry, the Switching 
Engine will transmit the message to the ports listed in 
the entry: 1 and 5 (I.e. the multicast router and host 4). 
[0034] After receiving the IGMP Leave message of 
the member, the multicast router extracts the vlan ID 
(vlan 1 ) from the message, and obtains the correspond- 
ing entry through searching in the multicast access priv- 
ilege table with the vlan ID. then delets multicast ad- 
dress 224.1.2.3 indicated by the IGMP Leave message 
in the entry as shown In Fig .9; i.e. after deleting address 
224.1.2.3 in the multicast group column (group) in the 
pane at right side of the multicast router, where the user 
who corresponds to vlan 1 has right to join in, the mul- 
ticast router completes the routine disposals on the 
leave message of the member; then generates and 
sends the HGMP Leave message to the switch; in the 
Fig.9, what corresponds to the HGMP Leave message 
is the downwards arrow drawn from the multicast router, 
the message comprises the vlan number of the host 
(vlan 1) which wants to leave the multicast group and 
the multicast address (224,1.2.3) that will be departed 
as well as the Leave command field. 
[0035] After receiving the HGMP Leave message, the 
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switch may obtain the entry through searching in the 
CAM table with MAC address 01 OO.SeOI .0203 that cor- 
responds to multicast address 224.1.2.3, and get port 2. 
number 2 of the host which sends the IGMP Leave mes- 
sage through searching with the vlan ID, and delete the s 
port number 2 from the entry. 
{0036) The steps above describe the detailed control 
processes on the multicast members of the controlled 
multicast method according to the present invention, 
moreover, the above method also comprises relevant 10 
control on the multicast sender as shown In Fig. 10. 
When the host (which is message resources (IDC) In 3. 
Fig. 10) transmits data to a certain multicast group, the 
multicast router which receives the data fn first place will 
download the multicast ACL (Access Control List, ACL « 
for short) first via the multicast service control server, 
and filter the data message with the multicast ACL, only 
the messages that satisfy the requirements can be for- 
warded to the Multicast Tree. Wherein, the multicast 
ACL is composed of the command word, the source ad- 20 
dress and the group address which is a destination ad- 
dress either. In order to avoid disadvantages caused by 
the discrete configuration, the centralized multicast 
service control server is usually adopted to distribute the 
multicast ACL to each multicast router which further 25 
controls the functions of senders; at same time, the mul- 
ticast service control server also acts as the AAA server, 
of course, the multicast ACL can also be distributed by 4. 
the centralized policy server or the network manager. 
[0037] The above system and method for implement- 30 
ing controlled multicast have been experimented In sev- 
eral apparatus designed by the applicant, the results are 
very successful, and the destination of control over the 
multicast is realized according to the present invention. 



Claims 

1. A controlled multicast system, including an Ethernet 
switch and a multicast router, where the Ethernet w 
switch connects with each host of a user in a down- 
link, connects with the multicast router in a uplink, 
the multicast router connects with a multicast router 
of other systems in the uplink, the Ethernet switch 
implementing multicast exchange of a layer 2, an « 
IGMP V2 protocol is adopted as group management 
protocol between the Ethernet switch and the host 
of the user; wherein the controlled multicast system 
further comprises; a portal server and an AAA serv- 
er that connect with the multicast router; the portal so 
server acting as an interface of user access authen- 
tication, the AAA server being used for storing con- 
figuration of privilege for the user to join in a multi- 
cast group; the multicast router cooperating with the 
AAA server together to Implement privilege authen- ss 
tication for the user to Join in the multicast group, 
and distributing control commands according to re- 
sults of the authentication to control multicast for- 



warding operations of the Ethernet switch. 

The controlled multicast system according to claim 
1, a RADIUS* protocol extended from an AAA pro- 
tocol is adopted as communication protocol be- 
tween the multicast router and the AAA server; a 
group management protocol HGMP (Huawel Group 
Management Protocol) is used as a control protocol 
between the Ethernet switch and the multicast rout- 



A method for implementing a controlled multicast, 
comprises: implementing access authentication 
first; then an Ethernet switch classifying a vlan ac- 
cording to a port and handling an IGMP message 
from a host, implementing user identification, au- 
thentication for joining in a multicast group, and a 
multicast router handling the IGMP message; in 
succession, the multicast router controlling the Eth- 
ernet switch for multicast forwarding, between 
which a HGMP protocol is used as a control protocol 
of the controlled multicasl; after that, the Ethernet 
switch disposing a HGMP control message and for- 
warding a multicast flow; the host leaving the mul- 
ticast group and making corresponding processes 
after finishing the forwarding operation. 

The method according to claim 3, wherein the step 
of implementing access authentication comprises, 

(1 ) when accessing a network, the host input- 
ting an authentication information that includes 
a User ID and a password first through an in- 
terface provided by a portal server, and a AAA 
server authenticating identification of the host 
with the information; ones the authentication is 
successful, the multicast router recording the 
User ID and a corresponding vlan ID of the host 
in a multicast access privilege table of the user; 

the step of the Ethernet switch classifying 
the vlan according to the port and handling the 
IGMP message from the host comprises, 

(2) classifying the vlan according to the ports, 
with one vlan for each port, and linking one port 
to one host; searching a Content-Addressable 
Memory (CAM) table with a destination MAC 
address of the IGMP message sent by the host 
and forwarding the said IGMP message, of 
which forwarding process is same with that of 
a unicast message: If the port corresponding to 
the destination MAC address is found, forward- 
ing the multicast massage to the port, otherwise 
forwarding the multicast message to all the 
ports; 

the step of implementing user identifica- 
tion, authentication for joining in the multicasl 
group, and handling the IGMP message by the 
multicast router comprises, 
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(3) after receiving an IGMP Membership Report 
message, according to the vlan ID in the mes- 
sage, the multicast router finding the corre- 
sponding User ID and the host to which the 
IGMP Membership Report message belongs 5 
through searching in the multicast access priv- 
ilege table of the user recorded In step (1 ), and 
then sending an extended RADIUS authentica- 
tion message which Includes the User ID just 
found as the user name and the address of mul- »o 
ticast group in which the host wants to join as 
an attribute, to the AAA server for authentica- 
tion; 

the AAA server determining whether to 
accept the user based on services of the user; '5 
if the user has the suitable privilege, respond- 
ing with an acceptance message, otherwise re- 
turning a reject message; after receiving the re- 
ject message, the multicast router do nothing, 
but if receiving the acceptance message, the 20 
multicast router writing the address of the mul- 
ticast group In which the user can join Into the 
multicast access privilege table of the user, and 
implementing a routine disposal on join mes- 
sages of the host, then generating and trans- 25 
mfttlng a HGMP Join message to the Ethernet 
switch, which comprises the vfan ID corre- 
sponding to the port that links with the host 
which wants to join in the multicast group, the 
address of the multicast group that is applied 30 
for, and a Join command field; moreover, the 
multicast router also completing a routine 
processing of creating multicast forwarding tree 
on the IGMP Membership Report message just 
like an ordinary multicast router does; 35 

Ihe step of the multicast router controlling 
the Ethernel switch making the multicast for- 
warding with the HGMP protocol being control 
protocol of the controlled multicast comprises, 

(4) managing generation and deletion of an en- « 
try in the CAM table at the Ethernet switch by 
the multicast router; while allowing the host to 
join in the multicast group, the multicast router 
sending Ihe HGMP Join message that includes 

the vlan ID of the host which applies to join in 45 
the multicast group and the address of the mul- 
ticast group applied for to the Ethernet switch; 
when the multicast router wants to terminate 
the host joining in the multicast group, the mul- 
ticast router transmitting a HGMP Leave mes- so 
sage which comprises the vlan ID of the host 
which leaves the multicast group and the ad- 
dress of the multicast group where the host 
leaves; 

the step of the Ethernet switch disposing 55 5. 
the HGMP control message comprises, 

(5) after receiving the HGMP Join message, the 
Ethernet switch searching the CAM table with 



the MAC address corresponding to the address 
of the multicast group; if the entry correspond- 
ing with the address is found, Ihe Ethernet 
switch obtaining the port number of the host via 
searching in the CAM table with the vlan ID in 
the HGMP Join message, and then adding the 
port number into the said entry; if nothing is 
found, adding an entry in the CAM table, which 
comprises the MAC address corresponding to 
the multicast address, the port number of the 
host which applies to join in the multicast group, 
and the port number of the multicast router con- 
nected with the Ethernet switch; 

after receiving the HGMP Leave mes- 
sage, the Ethernet switch obtaining the entry 
through looking up the CAM table with the MAC 
address corresponding to the mullicast ad- 
dress of the multicast group, and getting the 
port number of the host through searching with 
the vlan ID, and then deleting the said port 
number from the said entry, if the said port 
number is the solely port of the said entry, de- 
leting the whole entry; 

the step of forwarding of the multicast 
flow comprises, 

(6) when receiving the multicast flow sent from 
the multicast source, the multicast router for- 
warding the multicast flow to an egress based 
on a CAM table; when handling the IGMP Mem- 
bership Report message of the host, the multi- 
cast router creating a multicast forwarding 
egress according to the real port of the Ethernet 
switch, and sending only one copy of the mul- 
ticast flow to the Ethernet switch; 

the step of the host leaving the multicast 
group comprises, 

(7) after finishing the multicast and wanting to 
leave the multicast group , the host sending an 
IGMP Leave message; after receiving the 
IGMP Leave message, the multicast router ex- 
tracting the vlan ID from the massage, and ob- 
taining corresponding entry via searching in the 
multicast access privilege table created in step 
(1) with the vlan ID, then deleting the address 
of the multicast group indicated by the IGMP 
Leave message in the entry; after completing a 
routine disposal on leave messages; the multi- 
cast router generating the HGMP Leave mes- 
sage and sending to the Ethernet switch, which 
includes the vlan ID of the host which wants to 
leave group, the address of multicast group 
where the host wants to leave and a Leave 
command field. 

The method according to claim 3, wherein Ihe CAM 
table and the unlcast forwarding table of the Ether- 
net switch are shared. 
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8. The method according to claim 3, wherein, during 
the messages forwarding, adopting a vlan protocol 
between the port of the multicast router and the Eth- 
ernet switch. 

s 

7. The method according to daim 3, in step (6) there 
is no vlan ID in a multicast data packet of the mul- 
ticast flow sent from the multicast router. 

8. The method according to claim 3, in step (7) of leav- *0 
ing from the multicast group can also be implement- 
ed via following means which comprises, once the 
multicast router knows offline status of the user, the 
multicast router actively sending the HGMP Leave 
message to terminate multicast flow transmission 15 
to the host, which Is same with that of processing 

on the IGMP Leave message. 

9. The method according to claim 3, further comprises 
controlling the multicast sender, which includes 20 
when the host transmits data to the multicast group, 

the first receiver among the multicast routers filter- 
ing the data message with a multicast Access Con- 
trol List (ACL), and forwarding the data message 
that satisfies the requirements in the ACL to the 25 
multicast tree. 

10. The method according to claim 9, wherein the mul- 
ticast ACL comprises a command word, a source 
address and a group address. 30 

11. The method according to claim 9, wherein the mul- 
ticast ACL is distributed to each multicast router by 
a centralized multicast service control server; the 
step of controlling the sender is accomplished with 35 
the multicast ACL by the multicast router, mean- 
while the multicast service control server is also 
acts as the AAA server. 

12. Themethodaccording1oclaim9orclaim11, where- 40 
in the multicast ACL can also be distributed by a 
centralized policy server or a network manager. 
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